Texas City Refinery explosion — safety out of focus

1 4 | Loss Prevention Bulletin 275 October 2020 Institution of Chemical Engineers0260-9576/20/$ + city Refinery explosion safety out of focusKalokson Gurung, Laya Jayadeep, Janusz Siwek, Satyam Vora & David Zhou, University of Bradford, UKSIESO MedalHow the incident occurredAt 02:05 am on 23 March 2005, a hydrocarbon isomerisation (ISOM) unit at the Texas city Refinery was restarted after being down for maintenance. During start-up, unofficial procedures were followed as the tower was filled over the procedural guideline. The raffinate level was solely determined using the tower s torque-tube displacer type level transmitter, which was not calibrated for the specific gravity of the fluid1.

2 The operator stopped the filling process after the transmitter indicated a level of , when the true level was 4m. The informal procedure meant that the high-level alarm ( ) was ignored. Additionally, the secondary high-level alarm ( ) was faulty, which was not known to the operators. The restart was stopped for the day at that point, which was very the day shift briefing, it was decided the restart would be stopped as the heavy raffinate product tanks were full. The day supervisor, who arrived late and missed the briefing, gave the instruction to resume the start-up. The feed into the tower and the recirculation pumps were restarted.

3 However, miscommunication between operators meant that the heavy raffinate outlet was left closed. As a non-continuous restart was abnormal, the day board operator had to rely heavily on the experienced used to heat the fresh and recirculated feed into the tower were lit as per procedure. Shortly after this, the supervisor left the plant due to a family emergency without assigning a replacement, which was a deviation from protocol. This left the board operator alone to oversee the restart of the ISOM and monitor other units. By this point, the raffinate level reached 20m. At 11:56 am, fuel to the burners was increased further and the raffinate level reached 30m.

4 This was fifteen times the normal level, though the level transmitter indicated a safe level of and 23 March 2005, an explosion erupted at BP s Texas city Refinery , which resulted in 15 fatalities, 180 injured and $3 billion in damages and legal settlements. It is one of the worst industrial disasters to date. The explosion was caused by the overfilling of the raffinate splitter tower and a blowdown drum releasing hot hydrocarbons. The resulting vapour cloud ignited, destroying the ISOM unit. This article describes the events and associated failures which led to this incident, and explores how effective Process safety Management could have readily prevented the tragedy.

5 Keywords: Texas CityFigure 1 Summary of hazardous events and applicable barriers2:15amContractor trailers in hazardous areaTrailers not considered when starting upUsage of informal proceduresAlarm is faultyLevel indicator calibration outdatedInadequate assessment of risksPressure relief system is obsoleteA vehicle was parked near the blowdownKey:PSSRUp-to-date proceduresMechanical Integrity ProgrammeManagement of ChangeDetailed PHA on all systemsMechanical Integrity programmeControl of Ignition SourcesCauseEventBarrierTower filled above design range and level alarm ignoredRedundant high-level alarm does not soundLevel indicator showed incorrect levelBlowdown drum overfills with raffinateBlowdown drum vents to atmosphereVapour cloud reaches ignition source1.

6 20pm explosion OccursLoss Prevention Bulletin 275 October 2020 | 5 Institution of Chemical Engineers0260-9576/20/$ + leading and lagging indicators should be used to effectively measure the health of a plant with respect to PSM. Lagging indicators, such as the monthly loss of containment incidents, use historical data to highlight areas for improvement7. Leading indicators use routine checks or audits to improve safety performance, therefore creating an early barrier against critical failures. A leading indicator that could have been useful in Texas city is the measure of the length of time equipment was left in a failed state as a percentage of the plant s both been used, they could have exposed the latent failures at the Refinery , such as the faulty alarms.

7 Such indicators point to critical safety issues and can be used to drive and direct proactive, remedial integrityMechanical integrity refers to the management of critical process equipment and instrumentation such that it is correctly designed, installed, operated and maintained10. There were multiple mechanical failures at the Texas city refinery1: The raffinate splitter tower level indicator was incorrectly calibrated and did not display the true raffinate level. The redundant high-level alarm of the raffinate splitter tower level was non-functional and did not sound. The level sight glass was dirty and therefore prevented manual verification of the raffinate level.

8 The manual vent valve that allowed operators to vent vapour from the raffinate splitter tower was non-functional during start-up testing. The high-level alarm on the blowdown drum was non-functional and did not good mechanical integrity program will ensure that the process equipment and its instrumentation meet all safety requirements throughout their operational lifetime. It also requires that all relevant employees have sufficient training and tools to maintain the equipment and that the equipment is inspected cultureAn effective PSM requires the investigation of each incident that resulted in, or could reasonably have resulted in, a catastrophic release of a highly hazardous chemical11.

9 Prior to the disaster, both Texas city Refinery and the wider organisation lacked a learning culture. Accidents, such as a previous flammable release from the blowdown, were not adequately investigated. In addition, findings from past reports were often not acted upon. If a learning culture was in place, repeated common issues would have been resolved and the plant better means identifying the root causes of incidents, communicating lessons and implementing new control measures. Additionally, similar root causes can be present on other sites, so it is important to share the learnings company-wide. In this instance, lessons from incidents at BP Grangemouth, which highlighted similar deficiencies in process safety metrics and communication, could have been shared and the tragedy to the accident, some investigations were stopped at operator error as the root cause12.

10 However, operator (human) error is not a true root cause human error can be divided into three broad categories of skill-based errors, mistakes and violations13. It is possible to create safeguards to reduce the risk of human error, for example process automation. It was not until 12:49 pm that the level control valve was fully open, however the level kept increasing. At that point, the level in the tower reached 48m triggering liquid flow into the vapour line. The generated hydrostatic head activated the pressure relief valves near the base of the column, which redirected the flow into a blowdown drum. 195,600 litres of flammable fluid entered the blowdown drum, quickly overfilling and discharging to the atmosphere.